T1556.003: Pluggable Authentication Modules
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so
, which retrieves, sets, and verifies account authentication information in /etc/passwd
and /etc/shadow
.
Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so
, can be patched to accept arbitrary adversary supplied values as legitimate credentials.
Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.
Positive Technologies products that cover the technique
MaxPatrol SIEM knowledge base
hashicorp: PT-CR-2138: Hashicorp_Vault_Auth_Method_Modify: Attackers can enable or change available authentication methods
unix_mitre_attck_cred_access: PT-CR-1695: Unix_PAM_Modify: Configuration files of the pluggable authentication module were changed and moved. Attackers can change pluggable authentication module configuration to access user credentials or log in without a password.
Detection
ID | DS0028 | Data source and component | Logon Session: Logon Session Creation | Description | Monitor for newly constructed logon behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). |
---|
ID | DS0022 | Data source and component | File: File Modification | Description | Monitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. |
---|
Mitigation
ID | M1032 | Name | Multi-factor Authentication | Description | Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. |
---|
ID | M1026 | Name | Privileged Account Management | Description | Limit access to the root account and prevent users from modifying PAM components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities. |
---|